Arbitrary method call in Kirby's REST API search (CVE-2026-44174)

CVE-2026-44174 is an arbitrary method call vulnerability in Kirby's REST API search and collection query endpoints. Affected releases did not validate model attributes used in collection queries, allowing authenticated Panel users to invoke arbitrary model methods including those that disclose sensitive data (e.g., password hashes, filesystem paths) or perform destructive actions (e.g., privilege escalation via loginPasswordless(), mass deletion via delete()). This vulnerability is rated high severity with high real-world impact against Kirby sites with authenticated Panel users. Affected versions: - <=4.9.0 - 5.0.0-5.4.0 We recommend updating to: 4.9.1, 5.4.1. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/getkirby/kirby/security/advisories/GHSA-86rh-h242-j8xp Details: https://vuln.today/cve/CVE-2026-44174